It sort of depends on what bugs are fixed. CSA's strength is that it is not signature-dependent, so we don't release updates whenever a new vulnerability/worm/virus/etc is released. The update process is just for standard bug fixes like any product, so we can't really say how often we'll release new versions.
To give you an example though, here's the software release table for CSA:
http://www.cisco.com/cgi-bin/tablebuild.pl/csa
Note there's about 5 months between 4.01 and 4.02, you can view the 4.02 readme file at the top for information on what bugs are fixed in it.
There's no exact word at this point when a 4.03 will be released, looks like around July/August timeframe but it's not finalised yet.
